Added curve_exists() to pk-backend. That allows to determine which curves are available.

diff --git a/lib/algorithms/ecc.c b/lib/algorithms/ecc.c
index 3aa4000f9d4045392b05cb63ced85e5d09011e77..015c5d0e23113c254cef78dd790dc17afaf8902a 100644 (file)
--- a/lib/algorithms/ecc.c
+++ b/lib/algorithms/ecc.c
@@ -24,7 +24,7 @@
 #include <algorithms.h>
 #include <gnutls_errors.h>
 #include <x509/common.h>
-
+#include <gnutls_pk.h>
 
 /* Supported ECC curves
  */
@@ -36,35 +36,35 @@ static const gnutls_ecc_curve_entry_st ecc_curves[] = {
         .id = GNUTLS_ECC_CURVE_SECP192R1,
         .tls_id = 19,
         .size = 24,
-        },
+       },
        {
         .name = "SECP224R1",
         .oid = "1.3.132.0.33",
         .id = GNUTLS_ECC_CURVE_SECP224R1,
         .tls_id = 21,
         .size = 28,
-        },
+       },
        {
         .name = "SECP256R1",
         .oid = "1.2.840.10045.3.1.7",
         .id = GNUTLS_ECC_CURVE_SECP256R1,
         .tls_id = 23,
         .size = 32,
-        },
+       },
        {
         .name = "SECP384R1",
         .oid = "1.3.132.0.34",
         .id = GNUTLS_ECC_CURVE_SECP384R1,
         .tls_id = 24,
         .size = 48,
-        },
+       },
        {
         .name = "SECP521R1",
         .oid = "1.3.132.0.35",
         .id = GNUTLS_ECC_CURVE_SECP521R1,
         .tls_id = 25,
         .size = 66,
-        },
+       },
        {0, 0, 0}
 };
 
@@ -79,8 +79,11 @@ int _gnutls_tls_id_to_ecc_curve(int num)
 {
        gnutls_ecc_curve_t ret = GNUTLS_ECC_CURVE_INVALID;
 
-       GNUTLS_ECC_CURVE_LOOP(if (p->tls_id == num) {
-                             ret = p->id; break;}
+       GNUTLS_ECC_CURVE_LOOP(
+               if (p->tls_id == num && _gnutls_pk_curve_exists(p->id)) {
+                       ret = p->id; 
+                       break;
+               }
        );
 
        return ret;
@@ -103,7 +106,10 @@ const gnutls_ecc_curve_t *gnutls_ecc_curve_list(void)
        if (supported_curves[0] == 0) {
                int i = 0;
 
-               GNUTLS_ECC_CURVE_LOOP(supported_curves[i++] = p->id;);
+               GNUTLS_ECC_CURVE_LOOP(
+                       if (_gnutls_pk_curve_exists(p->id)) 
+                               supported_curves[i++] = p->id;
+               );
                supported_curves[i++] = 0;
        }
 
@@ -139,7 +145,7 @@ gnutls_ecc_curve_t _gnutls_oid_to_ecc_curve(const char *oid)
        gnutls_ecc_curve_t ret = GNUTLS_ECC_CURVE_INVALID;
 
        GNUTLS_ECC_CURVE_LOOP(
-               if (strcasecmp(p->oid, oid) == 0) {
+               if (strcasecmp(p->oid, oid) == 0 && _gnutls_pk_curve_exists(p->id)) {
                        ret = p->id;
                        break;
                }
@@ -162,7 +168,7 @@ gnutls_ecc_curve_t _gnutls_ecc_curve_get_id(const char *name)
        gnutls_ecc_curve_t ret = GNUTLS_ECC_CURVE_INVALID;
 
        GNUTLS_ECC_CURVE_LOOP(
-               if (strcasecmp(p->name, name) == 0) {
+               if (strcasecmp(p->name, name) == 0 && _gnutls_pk_curve_exists(p->id)) {
                        ret = p->id;
                        break;
                }
@@ -183,7 +189,7 @@ gnutls_ecc_curve_t _gnutls_ecc_bits_to_curve(int bits)
        gnutls_ecc_curve_t ret = GNUTLS_ECC_CURVE_SECP224R1;
 
        GNUTLS_ECC_CURVE_LOOP(
-               if (8 * p->size >= bits) {
+               if (8 * p->size >= bits && _gnutls_pk_curve_exists(p->id)) {
                        ret = p->id;
                        break;
                }

diff --git a/lib/crypto-backend.h b/lib/crypto-backend.h
index 89cb239f0bf1edda9dfd586eacf2a6a555ebdb1e..e273c0da321e22094c3690ff93d0190a22c4d77d 100644 (file)
--- a/lib/crypto-backend.h
+++ b/lib/crypto-backend.h
@@ -324,7 +324,7 @@ typedef struct gnutls_crypto_pk {
                       const gnutls_pk_params_st * priv,
                       const gnutls_pk_params_st * pub);
 
-
+       int (*curve_exists) (gnutls_ecc_curve_t);       /* true/false */
 } gnutls_crypto_pk_st;
 
 /* priority: infinity for backend algorithms, 90 for kernel

diff --git a/lib/gnutls_pk.h b/lib/gnutls_pk.h
index 46eb3d4f7a572f172bcfe81e4cbddebc870ec77d..6b5d5dbf6c681876e76f483964d8ce0a487719be 100644 (file)
--- a/lib/gnutls_pk.h
+++ b/lib/gnutls_pk.h
@@ -35,6 +35,7 @@ extern gnutls_crypto_pk_st _gnutls_pk_ops;
 #define _gnutls_pk_generate_keys( algo, bits, priv) _gnutls_pk_ops.generate_keys( algo, bits, priv)
 #define _gnutls_pk_generate_params( algo, bits, priv) _gnutls_pk_ops.generate_params( algo, bits, priv)
 #define _gnutls_pk_hash_algorithm( pk, sig, params, hash) _gnutls_pk_ops.hash_algorithm(pk, sig, params, hash)
+#define _gnutls_pk_curve_exists( curve) _gnutls_pk_ops.curve_exists(curve)
 
 inline static int
 _gnutls_pk_fixup(gnutls_pk_algorithm_t algo, gnutls_direction_t direction,

diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
index 2245af0db5bc4a5ffb41bdf20ce32d9e12d1f8c9..619d31c5dbe357e9b77b6071b7bf62617e54964d 100644 (file)
--- a/lib/nettle/pk.c
+++ b/lib/nettle/pk.c
@@ -667,6 +667,11 @@ static inline const struct ecc_curve *get_supported_curve(int curve)
        }
 }
 
+static int _wrap_nettle_pk_curve_exists(gnutls_ecc_curve_t curve)
+{
+       return ((get_supported_curve(curve)!=NULL)?1:0);
+}
+
 /* Generates algorithm's parameters. That is:
  *  For DSA: p, q, and g are generated.
  *  For RSA: nothing
@@ -1355,4 +1360,5 @@ gnutls_crypto_pk_st _gnutls_pk_ops = {
        .generate_keys = wrap_nettle_pk_generate_keys,
        .pk_fixup_private_params = wrap_nettle_pk_fixup,
        .derive = _wrap_nettle_pk_derive,
+       .curve_exists = _wrap_nettle_pk_curve_exists,
 };